In a Denial-of-Service (DoS) attack, an attacker floods a target network or server with a large volume of message traffic. Handling this traffic consumes the available resources of the target, and eventually brings the target to a situation in which it is unable to serve its legitimate clients. Distributed DoS (DDoS) attacks are often more damaging, as they involve creating artificial network traffic from multiple sources simultaneously.
Several methods and systems for protection against DDoS attacks are known in the art. For example, Cisco Systems, Inc. (San Jose, Calif.) offer a product called Traffic Anomaly Detector XT 5600. The anomaly detector compares current network activity to profiles of known “normal” behavior, in order to detect DDoS, worm, and other attacks. The traffic anomaly detector sometimes operates in conjunction with another Cisco product called Cisco Guard XT 5650. The XT 5650 can be alerted by a traffic anomaly detector or other standards-based detection solution, such as a firewall or intrusion detection system (IDS). When alerted, the XT 5650 diverts traffic destined for a targeted device, in order to identify and block the specific packets and flows responsible for the attack while allowing legitimate transactions to pass. Information regarding the XT 5600 and XT 5650 is available at www.cisco.com/en/US/products/ps5892 and www.cisco.com/en/US/products/ps5894, respectively.
The present invention will be more fully understood from the following detailed description of the embodiments thereof, taken together with the drawings in which: